The Internet has achieved widespread acceptance with the consuming public. Today people routinely conduct business or other personal transactions using the Internet. For instance, many people to use the Internet to conduct online banking or to manage their credit card accounts. The acceptance of the Internet has led to certain malicious individuals seeking to exploit some people's lack of understanding of Internet software. For example, one scheme, known as “phishing”, is used by malicious individuals to trick unwary Internet users into believing they are at a trusted site when in fact they are at the malicious individuals' site. The malicious individuals then capitalize on this misunderstanding by prompting the users for certain personal information, such as bank account numbers, credit card numbers, social security numbers, user login I.D.'s, passwords, and the like. These phishing schemes seem to be more effective than one may think.
One technique, termed Secure Sockets Layer or “SSL”, is used to make a consumer's browsing experience more safe. In short, SSL is a technique for establishing trust between a remote computing system, such as an e-commerce server, and a local computing system, such as the consumer's computer. The entity that controls the remote computing system obtains an “SSL certificate” from a Certificating or Certifying Authority (“CA”). The CA is a highly trusted organization that assumes the responsibility of verifying the identify of entities or individuals that request a certificate, and then issuing the certificates to them. The SSL certificate is essentially an electronic document, digitally signed by the CA, that is un-modifiable and affirmatively associates a particular domain with a particular entity.
When the local computing system initiates a session with the remote computing system (which is inside the certified domain), the remote computing system returns the SSL certificate to the local computing system. The local computing system determines from the SSL certificate the identity of the CA that signed it. The local computing system then uses a locally-stored version of the CA's root certificate to verify the integrity of the remote computer's SSL certificate. If the remote computer's SSL certificate is valid and in-date, the local computer negotiates an encrypted session with the now-validated remote computing system. This encrypted session may be used to safely conduct sensitive transactions, such as online banking or e-commerce.
It should be apparent that the authenticity, validity, and even existence of the particular SSL certificate is of paramount importance to the value of the SSL protocol. However, most users are completely unaware that such a certificate even exists during an SSL session. Some browsing software may present a small icon or the like to indicate little more than the fact that a secure SSL session has been started. But importantly, few users know how to evaluate the information contained in the certificate because conventional technologies hide the certificate in the background and only use it to set up the secure session.
An adequate mechanism for conveying to a user the legitimacy of a session with a Web site has eluded those skilled in the art, until now.